ryanstraight · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -0,0 +1,13 @@
+# Force LF line endings for text formats this package's own tests and
+# reproducibility guarantees depend on being byte-stable across platforms.
+# Without this, Windows checkouts with core.autocrlf=true silently convert
+# LF to CRLF on checkout, which fails the conformance goldens' "LF line
+# endings, no CR byte" contract (inst/conformance/README.md) even though
+# nothing about the data changed.
+*.csv text eol=lf
+*.nt text eol=lf
+*.json text eol=lf
+*.R text eol=lf
+*.Rd text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
@@ -22,7 +22,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ['3.12', '3.13', '3.14']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
         include:
           - {os: windows-latest, python-version: '3.12'}
           - {os: macos-latest,   python-version: '3.12'}

diff --git a/AGENTS.md b/AGENTS.md
@@ -12,8 +12,10 @@ reference index.
 R package providing a reproducible JSON-LD + SPARQL pipeline for
 analyzing cybersecurity workforce competency frameworks (NICE, DCWF,
 SFIA, ENISA ECSF, CyQUAL, the Canadian Cyber Security Skills Framework,
-Singapore's OTCCF) and pedagogical/learning-standards frameworks
-(Cyber.org K-12, CSTA K-12 CS, ACM/IEEE CSEC2017, JRC DigComp 2.2). The
+Singapore's OTCCF, the Saudi Cybersecurity Workforce Framework) and
+pedagogical/learning-standards frameworks and bodies of knowledge
+(Cyber.org K-12, CSTA K-12 CS in its 2017 and 2026 editions, ACM/IEEE
+CSEC2017, JRC DigComp 3.0, the UK's CyBOK). The
 intellectual contribution is a framework-agnostic schema (`cybed:`) that
 lets one query operate across heterogeneous frameworks. The
 implementation enforces the schema and provides analytical helpers.
@@ -58,7 +60,7 @@ repo. Stage them under `data/raw/<slug>/` per
 ## Test, document, build
 
 ```sh
-# Run the test suite (roughly 550 tests)
+# Run the test suite
 Rscript -e "devtools::test()"
 
 # Regenerate man/ + NAMESPACE after roxygen comment changes

diff --git a/CITATION.cff b/CITATION.cff
@@ -1,8 +1,8 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite it as below."
 type: software
-title: "cybedtools: An R Package for Reproducible Analysis of Cybersecurity Workforce and Learning Frameworks"
-version: 0.3.1
+title: "cybedtools: A Package for Reproducible Analysis of Cybersecurity Workforce and Learning Frameworks"
+version: 0.4.0
 # Zenodo concept DOI: the parent identifier that resolves to the latest
 # released version (currently 10.5281/zenodo.20076116, verified against
 # the Zenodo project's "Cite all versions" link). This DOI does not
@@ -36,12 +36,13 @@ keywords:
 abstract: >-
   cybedtools provides a reproducible R pipeline for ingesting, semantically
   representing (via a two-tier JSON-LD schema), and querying (via SPARQL)
-  eleven major cybersecurity-related competency and learning-standards
-  frameworks: NICE, DCWF, SFIA, ENISA ECSF, Cyber.org K-12, CSTA K-12 CS,
-  ACM/IEEE CSEC2017, DigComp 2.2, CyQUAL, CCSSF, and OTCCF. The cybed:
-  vocabulary uses
+  cybersecurity-related competency and learning-standards frameworks,
+  including NICE, DCWF, SFIA, ENISA ECSF, Cyber.org K-12, CSTA K-12 CS,
+  ACM/IEEE CSEC2017, DigComp 3.0, CyQUAL, CCSSF, and OTCCF. See
+  framework_summary() in the package for the current list and counts. The
+  cybed: vocabulary uses
   cybed:OrganizingUnit as the cross-framework abstract for parent units
   and cybed:Role as a workforce-restricted subtype, with cybed:Subpoint
   and cybed:Example separating framework-as-specified enumerations from
-  pedagogical-scaffolding examples. Includes a six-layer data-integrity
+  pedagogical-scaffolding examples. Includes a layered data-integrity
   verification rig and per-framework provenance manifests.
diff --git a/DESCRIPTION b/DESCRIPTION
@@ -1,8 +1,8 @@
 Package: cybedtools
 Type: Package
-Title: Computational Tools for Analyzing Cybersecurity Workforce and
-    Learning Frameworks
-Version: 0.3.1
+Title: A Package for Reproducible Analysis of Cybersecurity Workforce
+    and Learning Frameworks
+Version: 0.4.0
 Authors@R: person(
     "Ryan", "Straight",
     email = "ryanstraight@arizona.edu",
@@ -14,7 +14,7 @@ Description: A reproducible pipeline for ingesting, representing, and
     'DCWF', 'SFIA', 'ENISA ECSF', 'CyQUAL', 'CCSSF', 'OTCCF') and
     cybersecurity-related pedagogical frameworks ('Cyber.org K-12',
     'CSTA K-12 CS', 'ACM/IEEE CSEC2017',
-    'DigComp 2.2'). Provides a framework-agnostic 'JSON-LD' schema
+    'DigComp 3.0'). Provides a framework-agnostic 'JSON-LD' schema
     ('cybed:') and 'SPARQL' query patterns for cross-framework analysis.
 License: MIT + file LICENSE
 Encoding: UTF-8
@@ -27,18 +27,19 @@ Imports:
     dplyr (>= 1.1.0),
     purrr,
     tibble,
+    tidyr,
     jsonlite,
     glue,
     here,
     rdflib,
     rlang,
-    lifecycle
+    lifecycle,
+    digest
 Suggests:
     readxl,
     readr,
     yaml,
     stringr,
-    digest,
     janitor,
     DBI,
     RSQLite,

diff --git a/LICENSING.md b/LICENSING.md
@@ -14,7 +14,7 @@ If you are using cybedtools for academic research:
 If you are integrating cybedtools into a commercial product:
 
 - The MIT license on the code accommodates this.
-- Framework content is mixed. Some frameworks (NICE, DCWF) are public domain. Others (SFIA, Cyber.org K-12, CSTA, ACM/IEEE, OTCCF) impose non-commercial or attribution constraints. Two (CyQUAL, OTCCF) are included by written permission of their stewards, and CCSSF is referenced as the Canadian Centre for Cyber Security asked. The terms given to cybedtools do not pass to you. Read the per-framework licenses in [`docs/framework-data-sources.md`](docs/framework-data-sources.md) before redistributing framework text. **It is incumbent upon you to obtain proper licensing**.
+- Framework content is mixed. Some frameworks (NICE, DCWF) are public domain. Others (SFIA, Cyber.org K-12, CSTA, ACM/IEEE, OTCCF) impose non-commercial or attribution constraints. Three (CyQUAL, OTCCF, CCSSF) are included by written permission of their stewards. CCSSF's credit reads "Copyright Government of Canada. Used with permission of the Canadian Centre for Cyber Security." The terms given to cybedtools do not pass to you. Read the per-framework licenses in [`docs/framework-data-sources.md`](docs/framework-data-sources.md) before redistributing framework text. **It is incumbent upon you to obtain proper licensing**.
 
 ## Scope of the MIT license
 
@@ -26,9 +26,12 @@ This license does NOT extend to:
     - **SFIA.** All use of SFIA is under licence from the SFIA Foundation, and the licence covers structure as well as text. The Foundation's General Terms and Conditions define the protected material as "The concept, content and structure of SFIA along with content from the SFIA website" and name "a skills database containing SFIA information" as a royalty-bearing product, so there is no structure-versus-text carve-out. Free tiers cover personal use and single-country corporate internal use. Redistribution and sub-licensing are prohibited at every tier. The third-party extract cybedtools reads carries no licence file and holds no SFIA licence it could pass on, and it does contain full skill descriptions, guidance notes and per-level descriptors. The SFIA portion of cybedtools is local-analysis-only: nothing SFIA beyond aggregate counts is published, and anyone staging SFIA needs their own licence.
     - **Cyber.org K-12.** CC BY-NC 4.0 (attribution, non-commercial), with a separate unconditional grant on the same page: "Authorization to reproduce this report in whole or in part is granted."
     - **CSTA.** CC BY-NC-SA 4.0 (attribution, non-commercial, share-alike). The label is read from CSTA's 2017-edition publication page, because the ingested XLSX carries no licence statement.
+    - **CSTA 2026.** CC BY-NC-SA 4.0 (attribution, non-commercial, share-alike), read from the 2026 standards document's own licence page. The same share-alike obligation applies.
+    - **SCyWF.** No licence notice on the document. Used by written permission of the National Cybersecurity Authority (NCA), 2026-09-20, on three conditions. NCA is cited as issuing body and source with a link to https://nca.gov.sa/en/pages/scywf.html. Everything taken from the document is carried verbatim. Everything cybedtools derives is marked as derived rather than presented as NCA content.
     - **ECSF.** The Role Profiles report PDF is CC BY 4.0 by its own notice. The JSON and XLSX that cybedtools ingests carry no notice of any kind, and rest instead on ENISA's site-wide notice: "Reproduction of ENISA material published on this website is authorized, provided the source is acknowledged, unless it is stated otherwise."
     - **CSEC2017.** "Copyright © 2017 by ACM, IEEE, AIS, IFIP / ALL RIGHTS RESERVED", with permission granted only "to use these curricular guidelines for the development of educational materials and programs. Other use requires specific permission." cybedtools publishes Knowledge Area names, counts and alignment scores, and no statement text. A permission request to ACM is being prepared.
-    - **DigComp 2.2.** CC BY 4.0 by the source PDF's own imprint page, with a prescribed citation carried in `docs/framework-data-sources.md`.
+    - **DigComp 3.0.** CC BY 4.0, verified three ways against the official data supplement's own `copyright.txt`, the JRC Data Catalogue record, and the DigComp 3.0 resources page, with a prescribed citation carried in `docs/framework-data-sources.md`. Replaces DigComp 2.2 in place.
+    - **CyBOK.** Open Government Licence v3.0, Crown Copyright NCSC 2021, read from the Introduction to CyBOK's own copyright page. The attribution CyBOK prescribes is carried verbatim: "CyBOK © Crown Copyright, The National Cyber Security Centre 2021, licensed under the Open Government Licence: http://www.nationalarchives.gov.uk/doc/open-government-licence/."
     - **NICE.** A US Government work, not subject to copyright in the United States under 17 U.S.C. 105. NIST reserves foreign rights and grants them back: "foreign rights are reserved. To the extent NIST may assert rights outside of the United States, the public is granted the non-exclusive, perpetual, paid-up, royalty-free, worldwide right to reprint works in all formats including print, electronically, and online, and in all subsequent editions, and derivative works."
     - **DCWF.** A US Government work prepared by DoD personnel, so not subject to US copyright under 17 U.S.C. 105. The v5.1 workbook carries no distribution statement, the DoD download pages now require authentication so none could be read, and nine work roles are tagged "(CUI)" in the workbook's role index. Review those sheets before any public deposit of DCWF-derived content.
 - **Framework analyses** produced by running this pipeline on framework source text. Derivative analytical outputs (code frequencies, cross-framework mappings) are generally safe to publish with attribution, but specific licensing turns on the source framework.
@@ -37,15 +40,15 @@ When redistributing or building on this toolkit, respect the upstream framework
 
 ## Frameworks included by steward permission
 
-Two frameworks are in cybedtools because their stewards said yes in writing, and the Canadian framework is here referenced as its steward asked. The terms differ, and none of them is as broad as MIT. Full detail, including how to obtain each source, is in [`docs/framework-data-sources.md`](docs/framework-data-sources.md).
+Three frameworks are in cybedtools because their stewards said yes in writing. The terms differ, and none of them is as broad as MIT. Full detail, including how to obtain each source, is in [`docs/framework-data-sources.md`](docs/framework-data-sources.md).
 
 **OTCCF, Cyber Security Agency of Singapore.** Derived from the Operational Technology Cybersecurity Competency Framework (OTCCF), published by the Cyber Security Agency of Singapore (CSA). Available at: https://www.csa.gov.sg/resources/publications/operational-technology-cybersecurity-competency-framework--otccf-/
 
 The document names Mercer Singapore as a joint developer alongside CSA, with SkillsFuture Singapore and the Infocomm Media Development Authority as supporters. Whether Mercer holds any interest that CSA's permission does not reach is unresolved.
 
 CSA's permission is for referencing and integrating the OTCCF's structure, for non-commercial, academic and research purposes, and it requires that the ingestion scripts and structural mappings not misrepresent or alter the intent of the OTCCF's job roles, skills, or competency mappings as published by CSA. cybedtools makes public only the OTCCF's structure (roles, skill titles, categories, proficiency levels, role-to-skill mappings) and not its statement text. Eight of its thirty skills and all of its Critical Core Skills originate with SkillsFuture Singapore, and the graph marks them. Commercial use of the OTCCF portion is outside what CSA granted.
 
-**CCSSF, Canadian Centre for Cyber Security.** Canadian Centre for Cyber Security, The Canadian Cyber Security Skills Framework (ITSM.00.039), 2022 edition. Copyright Government of Canada. Referenced as the Canadian Centre for Cyber Security asked. The Centre asks that its material be referenced when used.
+**CCSSF, Canadian Centre for Cyber Security.** Canadian Centre for Cyber Security, The Canadian Cyber Security Skills Framework (ITSM.00.039), 2022 edition. Copyright Government of Canada. Used with permission of the Canadian Centre for Cyber Security, granted 2026-09-21 for full-text publication with attribution.
 
 **CyQUAL, Masaryk University.** CyQUAL, the Czech national cybersecurity qualifications framework, developed at Masaryk University. Open data, version 1.2.0, https://platform.cyqual.cz/. Published as open data. Attribution to CyQUAL and to Masaryk University is required.
 

diff --git a/NAMESPACE b/NAMESPACE
@@ -13,17 +13,20 @@ export(build_role_element_node)
 export(build_role_node)
 export(build_subpoint_node)
 export(build_unit_relation_node)
+export(cybed_fetch)
 export(cybed_license)
 export(element_framework_bindings)
 export(element_text)
 export(example_framework_bindings)
 export(expand_with_subpoints)
 export(extend_role_element_ids)
 export(framework_metadata)
+export(framework_similarity)
 export(graph_identity_violations)
 export(graph_invariant_counts)
 export(load_combined_ntriples_graph)
 export(load_combined_rdf_graph)
+export(load_graph)
 export(load_single_framework_graph)
 export(load_unified_rdf_graph)
 export(make_demo_graph)
@@ -35,6 +38,8 @@ export(role_framework_bindings)
 export(sparql_pairs)
 export(sparql_subjects)
 export(subpoint_framework_bindings)
+export(unit_element_bindings)
+export(unit_relation_bindings)
 export(validate_jsonld_node)
 export(write_jsonld_document)
 importFrom(lifecycle,deprecated)